Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/10/2022, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe
Resource
win10v2004-20220901-en
General
-
Target
8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe
-
Size
72KB
-
MD5
010e69db7ad1be59282c3eb7212dda9b
-
SHA1
18b9a21141db9331dc79db8b452874715f9d773c
-
SHA256
8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc
-
SHA512
e28e467a4b60238d518f04b577bd6ce78bed4138afe68bffadb553513af8714bc25bb43c867afc9bfa80b971d976b85f7dc8e43ca5bf10fdaffcb97f122af276
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2Z:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPt
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 51 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 940 backup.exe 1980 backup.exe 2016 backup.exe 1904 backup.exe 1944 backup.exe 1484 backup.exe 1348 backup.exe 624 backup.exe 1960 backup.exe 696 backup.exe 284 backup.exe 1892 backup.exe 1952 System Restore.exe 1104 backup.exe 1776 backup.exe 1612 System Restore.exe 928 backup.exe 1736 backup.exe 2024 backup.exe 1724 backup.exe 1872 backup.exe 1688 backup.exe 1704 backup.exe 1336 backup.exe 1740 backup.exe 1804 backup.exe 1384 data.exe 1696 backup.exe 1036 backup.exe 1496 backup.exe 1964 backup.exe 1480 backup.exe 1692 backup.exe 1488 backup.exe 1460 backup.exe 1956 backup.exe 972 backup.exe 1296 backup.exe 1200 backup.exe 1396 backup.exe 1948 backup.exe 1612 backup.exe 1728 backup.exe 964 backup.exe 1932 backup.exe 1220 backup.exe 2032 backup.exe 1108 backup.exe 1872 backup.exe 1976 backup.exe 1212 backup.exe 1712 backup.exe 1744 backup.exe 1740 backup.exe 1348 backup.exe 1384 backup.exe 1340 backup.exe 1696 backup.exe 1784 backup.exe 1924 backup.exe 292 System Restore.exe 1320 backup.exe 1900 backup.exe 1928 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 624 backup.exe 624 backup.exe 1960 backup.exe 1960 backup.exe 624 backup.exe 624 backup.exe 284 backup.exe 284 backup.exe 1892 backup.exe 1892 backup.exe 284 backup.exe 284 backup.exe 1104 backup.exe 1104 backup.exe 1776 backup.exe 1776 backup.exe 1776 backup.exe 1776 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 928 backup.exe 284 backup.exe 928 backup.exe 928 backup.exe 284 backup.exe 624 backup.exe 1776 backup.exe 1104 backup.exe 1776 backup.exe -
Drops file in Program Files directory 56 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\System Restore.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\data.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe -
Suspicious use of SetWindowsHookEx 58 IoCs
pid Process 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 940 backup.exe 1980 backup.exe 2016 backup.exe 1904 backup.exe 1944 backup.exe 1484 backup.exe 1348 backup.exe 624 backup.exe 1960 backup.exe 696 backup.exe 284 backup.exe 1892 backup.exe 1952 System Restore.exe 1104 backup.exe 1776 backup.exe 1612 System Restore.exe 928 backup.exe 1736 backup.exe 2024 backup.exe 1724 backup.exe 1872 backup.exe 1688 backup.exe 1704 backup.exe 1336 backup.exe 1740 backup.exe 1804 backup.exe 1384 data.exe 1696 backup.exe 1036 backup.exe 1480 backup.exe 1496 backup.exe 1964 backup.exe 1692 backup.exe 1488 backup.exe 1956 backup.exe 1460 backup.exe 1296 backup.exe 1200 backup.exe 1396 backup.exe 1612 backup.exe 1728 backup.exe 1220 backup.exe 1932 backup.exe 964 backup.exe 1108 backup.exe 2032 backup.exe 1948 backup.exe 1872 backup.exe 1976 backup.exe 1212 backup.exe 1740 backup.exe 1712 backup.exe 1384 backup.exe 1744 backup.exe 1348 backup.exe 1340 backup.exe 1784 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 940 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 27 PID 1868 wrote to memory of 940 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 27 PID 1868 wrote to memory of 940 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 27 PID 1868 wrote to memory of 940 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 27 PID 1868 wrote to memory of 1980 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 28 PID 1868 wrote to memory of 1980 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 28 PID 1868 wrote to memory of 1980 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 28 PID 1868 wrote to memory of 1980 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 28 PID 1868 wrote to memory of 2016 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 29 PID 1868 wrote to memory of 2016 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 29 PID 1868 wrote to memory of 2016 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 29 PID 1868 wrote to memory of 2016 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 29 PID 1868 wrote to memory of 1904 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 30 PID 1868 wrote to memory of 1904 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 30 PID 1868 wrote to memory of 1904 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 30 PID 1868 wrote to memory of 1904 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 30 PID 1868 wrote to memory of 1944 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 31 PID 1868 wrote to memory of 1944 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 31 PID 1868 wrote to memory of 1944 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 31 PID 1868 wrote to memory of 1944 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 31 PID 1868 wrote to memory of 1484 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 32 PID 1868 wrote to memory of 1484 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 32 PID 1868 wrote to memory of 1484 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 32 PID 1868 wrote to memory of 1484 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 32 PID 1868 wrote to memory of 1348 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 33 PID 1868 wrote to memory of 1348 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 33 PID 1868 wrote to memory of 1348 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 33 PID 1868 wrote to memory of 1348 1868 8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe 33 PID 940 wrote to memory of 624 940 backup.exe 34 PID 940 wrote to memory of 624 940 backup.exe 34 PID 940 wrote to memory of 624 940 backup.exe 34 PID 940 wrote to memory of 624 940 backup.exe 34 PID 624 wrote to memory of 1960 624 backup.exe 35 PID 624 wrote to memory of 1960 624 backup.exe 35 PID 624 wrote to memory of 1960 624 backup.exe 35 PID 624 wrote to memory of 1960 624 backup.exe 35 PID 1960 wrote to memory of 696 1960 backup.exe 36 PID 1960 wrote to memory of 696 1960 backup.exe 36 PID 1960 wrote to memory of 696 1960 backup.exe 36 PID 1960 wrote to memory of 696 1960 backup.exe 36 PID 624 wrote to memory of 284 624 backup.exe 37 PID 624 wrote to memory of 284 624 backup.exe 37 PID 624 wrote to memory of 284 624 backup.exe 37 PID 624 wrote to memory of 284 624 backup.exe 37 PID 284 wrote to memory of 1892 284 backup.exe 38 PID 284 wrote to memory of 1892 284 backup.exe 38 PID 284 wrote to memory of 1892 284 backup.exe 38 PID 284 wrote to memory of 1892 284 backup.exe 38 PID 1892 wrote to memory of 1952 1892 backup.exe 39 PID 1892 wrote to memory of 1952 1892 backup.exe 39 PID 1892 wrote to memory of 1952 1892 backup.exe 39 PID 1892 wrote to memory of 1952 1892 backup.exe 39 PID 284 wrote to memory of 1104 284 backup.exe 40 PID 284 wrote to memory of 1104 284 backup.exe 40 PID 284 wrote to memory of 1104 284 backup.exe 40 PID 284 wrote to memory of 1104 284 backup.exe 40 PID 1104 wrote to memory of 1776 1104 backup.exe 41 PID 1104 wrote to memory of 1776 1104 backup.exe 41 PID 1104 wrote to memory of 1776 1104 backup.exe 41 PID 1104 wrote to memory of 1776 1104 backup.exe 41 PID 1776 wrote to memory of 1612 1776 backup.exe 42 PID 1776 wrote to memory of 1612 1776 backup.exe 42 PID 1776 wrote to memory of 1612 1776 backup.exe 42 PID 1776 wrote to memory of 1612 1776 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe"C:\Users\Admin\AppData\Local\Temp\8d406dae2ac6e6b4db07d2cfc236a5caaac6d6602e32e68131d36c40f387e8dc.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\985137587\backup.exeC:\Users\Admin\AppData\Local\Temp\985137587\backup.exe C:\Users\Admin\AppData\Local\Temp\985137587\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:940 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:624 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1960 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:696
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:284 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1892 -
C:\Program Files\7-Zip\Lang\System Restore.exe"C:\Program Files\7-Zip\Lang\System Restore.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1952
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1104 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:928 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1724
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1804
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1384
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1036 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1396
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1220
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1744
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
PID:1928
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵PID:1336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵PID:1888
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵PID:1044
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1496
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
PID:972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
PID:1320
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:1968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:1160
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:2024
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1480 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1108
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Executes dropped EXE
PID:1976
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:920
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1656
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Drops file in Program Files directory
PID:1104
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1296 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:836
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\update.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1268
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:908
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1368
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:2140
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1488
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1956 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2032
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1740 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1340
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1620
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1940
-
-
C:\Program Files\Common Files\System\es-ES\System Restore.exe"C:\Program Files\Common Files\System\es-ES\System Restore.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:796
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1608
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:2040
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2132
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1964 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1948
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1784
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1724
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1976
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:1748
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1904
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:2120
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1460 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1728 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1348 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵PID:2108
-
-
-
-
-
C:\Program Files\Internet Explorer\System Restore.exe"C:\Program Files\Internet Explorer\System Restore.exe" C:\Program Files\Internet Explorer\5⤵
- Executes dropped EXE
PID:292
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1864
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1224
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:920
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2148
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1692 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1612 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1872 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1384
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵PID:1488
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:1884
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1460
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:1032
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1944
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:624
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1200 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1932 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:760
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:964
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:1140
-
-
C:\Users\Admin\Favorites\System Restore.exe"C:\Users\Admin\Favorites\System Restore.exe" C:\Users\Admin\Favorites\6⤵PID:1716
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:2004
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Executes dropped EXE
PID:1900
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Executes dropped EXE
PID:1924
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1944
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1484
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1348
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5a3b721ba9623ba87dedac1fd3e3191c9
SHA1a65844c42aab2f19930e5f8ec38cbe8dda240a1a
SHA256354f62921734fe15bf9ba99b4b6da016eecfcf4143d35fa31aa6c58c947ee250
SHA512d6de75704563d33a7a123f27e238b8b93102385aafbbe104bfbf61db3e3db7de8a39dc732044a021f574ec37425ac9399a1bc6fc279ffb21a6b6e65650051271
-
Filesize
72KB
MD55e14d061f334ab3f9dfde5d3d5dce611
SHA194e64b32d9a3671fe33ed9a456d83678f3b86562
SHA2561a7827ff29a6ecc7e279072e425df0da9e8e4e2fa997fc51b025ff17d2685107
SHA512483e36245939022c1146c0a219e9a609ac51b9f0b65a8bdd4d1605c355e6fc7713aeb9af2b8d21291d202222182677a8f07fe27f8c66c5a645b5b4f7b4bf2d13
-
Filesize
72KB
MD55e14d061f334ab3f9dfde5d3d5dce611
SHA194e64b32d9a3671fe33ed9a456d83678f3b86562
SHA2561a7827ff29a6ecc7e279072e425df0da9e8e4e2fa997fc51b025ff17d2685107
SHA512483e36245939022c1146c0a219e9a609ac51b9f0b65a8bdd4d1605c355e6fc7713aeb9af2b8d21291d202222182677a8f07fe27f8c66c5a645b5b4f7b4bf2d13
-
Filesize
72KB
MD5e061b554495561443e41e873f7f56ac3
SHA15aaceca60a2ab975b7ecbb696d3a09ca68ddab3f
SHA256384dd6aea6348e4b2e3ea79d9048938585d2f46125fe41a84cc752b5f9050714
SHA512979533bb2e13438465853d5e4ec54539084987320eec6187b106d4d9e83f42ece4fe547fac2e866d1ce6e1141918af9bdbca2164937c04b78752c9ad7b2b4e27
-
Filesize
72KB
MD5a3b721ba9623ba87dedac1fd3e3191c9
SHA1a65844c42aab2f19930e5f8ec38cbe8dda240a1a
SHA256354f62921734fe15bf9ba99b4b6da016eecfcf4143d35fa31aa6c58c947ee250
SHA512d6de75704563d33a7a123f27e238b8b93102385aafbbe104bfbf61db3e3db7de8a39dc732044a021f574ec37425ac9399a1bc6fc279ffb21a6b6e65650051271
-
Filesize
72KB
MD5a3b721ba9623ba87dedac1fd3e3191c9
SHA1a65844c42aab2f19930e5f8ec38cbe8dda240a1a
SHA256354f62921734fe15bf9ba99b4b6da016eecfcf4143d35fa31aa6c58c947ee250
SHA512d6de75704563d33a7a123f27e238b8b93102385aafbbe104bfbf61db3e3db7de8a39dc732044a021f574ec37425ac9399a1bc6fc279ffb21a6b6e65650051271
-
Filesize
72KB
MD528da7f92d20426930987cbae61ab8d3f
SHA17c1bb1a8a5b0028e3fb70fa7a7c75f64fff221a2
SHA256c10aa6dfcdcc72c3aa4d909fc1318c0b3a848cb68139dd18d92efd3955bc000e
SHA51216dd7b670625fa49260f33d56b9bfab9e61982d39d989f32346bc12d952893c82df3402646d32133c66cd60291c97e1a59244ea467428fe39bcab7af1a3daff8
-
Filesize
72KB
MD5286d9f2e4b5b1728074b1df57bbd2ee0
SHA13d6ca9b5a4db8035c35bb8294dca786917f95bd7
SHA256ec7f0d4ff01fe4de50ca8fc99782ba8dcd1749f526f64ee1bc96094819cee745
SHA5128361492552ed0fdc5d544a2f21f1b09591473349a0409a2fd4b80f6536194d8ecf01a93944ad9725a52bd31ece31c4a5e52e82155d9ca4e5881d76e5d1715983
-
Filesize
72KB
MD5286d9f2e4b5b1728074b1df57bbd2ee0
SHA13d6ca9b5a4db8035c35bb8294dca786917f95bd7
SHA256ec7f0d4ff01fe4de50ca8fc99782ba8dcd1749f526f64ee1bc96094819cee745
SHA5128361492552ed0fdc5d544a2f21f1b09591473349a0409a2fd4b80f6536194d8ecf01a93944ad9725a52bd31ece31c4a5e52e82155d9ca4e5881d76e5d1715983
-
Filesize
72KB
MD538bc9f423e2e35637de6d0bd321fc2f6
SHA1e4ba499a3936134b05ebf469b73f713f1090a9ca
SHA256341ef1071a42f6347db0402f86b4807283a8b905b405e15d3989b1797c64c882
SHA512f489c6d4a838718f34f58558f9c4a175e0d4440f3705817a00f671e92840a7f3b46276ddf7b839379d6182c02f0c735854fd99643ad5270eb495aeb968d1488d
-
Filesize
72KB
MD528da7f92d20426930987cbae61ab8d3f
SHA17c1bb1a8a5b0028e3fb70fa7a7c75f64fff221a2
SHA256c10aa6dfcdcc72c3aa4d909fc1318c0b3a848cb68139dd18d92efd3955bc000e
SHA51216dd7b670625fa49260f33d56b9bfab9e61982d39d989f32346bc12d952893c82df3402646d32133c66cd60291c97e1a59244ea467428fe39bcab7af1a3daff8
-
Filesize
72KB
MD528da7f92d20426930987cbae61ab8d3f
SHA17c1bb1a8a5b0028e3fb70fa7a7c75f64fff221a2
SHA256c10aa6dfcdcc72c3aa4d909fc1318c0b3a848cb68139dd18d92efd3955bc000e
SHA51216dd7b670625fa49260f33d56b9bfab9e61982d39d989f32346bc12d952893c82df3402646d32133c66cd60291c97e1a59244ea467428fe39bcab7af1a3daff8
-
Filesize
72KB
MD538bc9f423e2e35637de6d0bd321fc2f6
SHA1e4ba499a3936134b05ebf469b73f713f1090a9ca
SHA256341ef1071a42f6347db0402f86b4807283a8b905b405e15d3989b1797c64c882
SHA512f489c6d4a838718f34f58558f9c4a175e0d4440f3705817a00f671e92840a7f3b46276ddf7b839379d6182c02f0c735854fd99643ad5270eb495aeb968d1488d
-
Filesize
72KB
MD514b0a6b7db12e78c01b2a161abbb3f6a
SHA1804fd228a75d657f0fbdb91d8b239a8844f402fe
SHA256cf8c01efe000d13f5d5f8e736f4930d5e45ffa841e62ef047072292aed08856d
SHA512b118ee5c6f83eb8c9c3e949d4abfc9750c70112e9fda9cca94d4a9b2b6b84e5d4d4f4ffd9c38f737b95872395b693d94fadef88e7dafc70be3ac75c2051ac9cd
-
Filesize
72KB
MD514b0a6b7db12e78c01b2a161abbb3f6a
SHA1804fd228a75d657f0fbdb91d8b239a8844f402fe
SHA256cf8c01efe000d13f5d5f8e736f4930d5e45ffa841e62ef047072292aed08856d
SHA512b118ee5c6f83eb8c9c3e949d4abfc9750c70112e9fda9cca94d4a9b2b6b84e5d4d4f4ffd9c38f737b95872395b693d94fadef88e7dafc70be3ac75c2051ac9cd
-
Filesize
72KB
MD55e14d061f334ab3f9dfde5d3d5dce611
SHA194e64b32d9a3671fe33ed9a456d83678f3b86562
SHA2561a7827ff29a6ecc7e279072e425df0da9e8e4e2fa997fc51b025ff17d2685107
SHA512483e36245939022c1146c0a219e9a609ac51b9f0b65a8bdd4d1605c355e6fc7713aeb9af2b8d21291d202222182677a8f07fe27f8c66c5a645b5b4f7b4bf2d13
-
Filesize
72KB
MD55e14d061f334ab3f9dfde5d3d5dce611
SHA194e64b32d9a3671fe33ed9a456d83678f3b86562
SHA2561a7827ff29a6ecc7e279072e425df0da9e8e4e2fa997fc51b025ff17d2685107
SHA512483e36245939022c1146c0a219e9a609ac51b9f0b65a8bdd4d1605c355e6fc7713aeb9af2b8d21291d202222182677a8f07fe27f8c66c5a645b5b4f7b4bf2d13
-
Filesize
72KB
MD5fbc286da952d8481a44cc828639b16da
SHA186444651a5a8b05936290404688f0d9693778d28
SHA2565f4c9bc1de9c2a62aa1c54815b956f16c7f75ff4c4012805c264536cfbf77348
SHA5125a4dd742f3bc46b5b8147af46f14e1a121f5beb7740de3a4caf7c2eae6735229afb0e65ca3f7b55f0041f72530cf92ff91fd07ad449b6cba3362a6057fcfa0b7
-
Filesize
72KB
MD5fbc286da952d8481a44cc828639b16da
SHA186444651a5a8b05936290404688f0d9693778d28
SHA2565f4c9bc1de9c2a62aa1c54815b956f16c7f75ff4c4012805c264536cfbf77348
SHA5125a4dd742f3bc46b5b8147af46f14e1a121f5beb7740de3a4caf7c2eae6735229afb0e65ca3f7b55f0041f72530cf92ff91fd07ad449b6cba3362a6057fcfa0b7
-
Filesize
72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
Filesize
72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
Filesize
72KB
MD5fbc286da952d8481a44cc828639b16da
SHA186444651a5a8b05936290404688f0d9693778d28
SHA2565f4c9bc1de9c2a62aa1c54815b956f16c7f75ff4c4012805c264536cfbf77348
SHA5125a4dd742f3bc46b5b8147af46f14e1a121f5beb7740de3a4caf7c2eae6735229afb0e65ca3f7b55f0041f72530cf92ff91fd07ad449b6cba3362a6057fcfa0b7
-
Filesize
72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
Filesize
72KB
MD5299f985a786d190c837b3e6b390985dd
SHA160a100fcad549cbccd19b710ac08bac201e78a6b
SHA2568895bd997c13e8fdee5b31793229a06451c93a6108c331b0e18bfb53ef7dad61
SHA51210ef3d1233acc32b83663c60b87a8bb634002cd6eab9f2844754bb70065c8acfecb0058ee6a335ce5943e26f41ecef2676cec0379bf63e8666a7f22767e86fe4
-
Filesize
72KB
MD5299f985a786d190c837b3e6b390985dd
SHA160a100fcad549cbccd19b710ac08bac201e78a6b
SHA2568895bd997c13e8fdee5b31793229a06451c93a6108c331b0e18bfb53ef7dad61
SHA51210ef3d1233acc32b83663c60b87a8bb634002cd6eab9f2844754bb70065c8acfecb0058ee6a335ce5943e26f41ecef2676cec0379bf63e8666a7f22767e86fe4
-
Filesize
72KB
MD5a3b721ba9623ba87dedac1fd3e3191c9
SHA1a65844c42aab2f19930e5f8ec38cbe8dda240a1a
SHA256354f62921734fe15bf9ba99b4b6da016eecfcf4143d35fa31aa6c58c947ee250
SHA512d6de75704563d33a7a123f27e238b8b93102385aafbbe104bfbf61db3e3db7de8a39dc732044a021f574ec37425ac9399a1bc6fc279ffb21a6b6e65650051271
-
Filesize
72KB
MD5a3b721ba9623ba87dedac1fd3e3191c9
SHA1a65844c42aab2f19930e5f8ec38cbe8dda240a1a
SHA256354f62921734fe15bf9ba99b4b6da016eecfcf4143d35fa31aa6c58c947ee250
SHA512d6de75704563d33a7a123f27e238b8b93102385aafbbe104bfbf61db3e3db7de8a39dc732044a021f574ec37425ac9399a1bc6fc279ffb21a6b6e65650051271
-
Filesize
72KB
MD55e14d061f334ab3f9dfde5d3d5dce611
SHA194e64b32d9a3671fe33ed9a456d83678f3b86562
SHA2561a7827ff29a6ecc7e279072e425df0da9e8e4e2fa997fc51b025ff17d2685107
SHA512483e36245939022c1146c0a219e9a609ac51b9f0b65a8bdd4d1605c355e6fc7713aeb9af2b8d21291d202222182677a8f07fe27f8c66c5a645b5b4f7b4bf2d13
-
Filesize
72KB
MD55e14d061f334ab3f9dfde5d3d5dce611
SHA194e64b32d9a3671fe33ed9a456d83678f3b86562
SHA2561a7827ff29a6ecc7e279072e425df0da9e8e4e2fa997fc51b025ff17d2685107
SHA512483e36245939022c1146c0a219e9a609ac51b9f0b65a8bdd4d1605c355e6fc7713aeb9af2b8d21291d202222182677a8f07fe27f8c66c5a645b5b4f7b4bf2d13
-
Filesize
72KB
MD5e061b554495561443e41e873f7f56ac3
SHA15aaceca60a2ab975b7ecbb696d3a09ca68ddab3f
SHA256384dd6aea6348e4b2e3ea79d9048938585d2f46125fe41a84cc752b5f9050714
SHA512979533bb2e13438465853d5e4ec54539084987320eec6187b106d4d9e83f42ece4fe547fac2e866d1ce6e1141918af9bdbca2164937c04b78752c9ad7b2b4e27
-
Filesize
72KB
MD5e061b554495561443e41e873f7f56ac3
SHA15aaceca60a2ab975b7ecbb696d3a09ca68ddab3f
SHA256384dd6aea6348e4b2e3ea79d9048938585d2f46125fe41a84cc752b5f9050714
SHA512979533bb2e13438465853d5e4ec54539084987320eec6187b106d4d9e83f42ece4fe547fac2e866d1ce6e1141918af9bdbca2164937c04b78752c9ad7b2b4e27
-
Filesize
72KB
MD5a3b721ba9623ba87dedac1fd3e3191c9
SHA1a65844c42aab2f19930e5f8ec38cbe8dda240a1a
SHA256354f62921734fe15bf9ba99b4b6da016eecfcf4143d35fa31aa6c58c947ee250
SHA512d6de75704563d33a7a123f27e238b8b93102385aafbbe104bfbf61db3e3db7de8a39dc732044a021f574ec37425ac9399a1bc6fc279ffb21a6b6e65650051271
-
Filesize
72KB
MD5a3b721ba9623ba87dedac1fd3e3191c9
SHA1a65844c42aab2f19930e5f8ec38cbe8dda240a1a
SHA256354f62921734fe15bf9ba99b4b6da016eecfcf4143d35fa31aa6c58c947ee250
SHA512d6de75704563d33a7a123f27e238b8b93102385aafbbe104bfbf61db3e3db7de8a39dc732044a021f574ec37425ac9399a1bc6fc279ffb21a6b6e65650051271
-
Filesize
72KB
MD528da7f92d20426930987cbae61ab8d3f
SHA17c1bb1a8a5b0028e3fb70fa7a7c75f64fff221a2
SHA256c10aa6dfcdcc72c3aa4d909fc1318c0b3a848cb68139dd18d92efd3955bc000e
SHA51216dd7b670625fa49260f33d56b9bfab9e61982d39d989f32346bc12d952893c82df3402646d32133c66cd60291c97e1a59244ea467428fe39bcab7af1a3daff8
-
Filesize
72KB
MD528da7f92d20426930987cbae61ab8d3f
SHA17c1bb1a8a5b0028e3fb70fa7a7c75f64fff221a2
SHA256c10aa6dfcdcc72c3aa4d909fc1318c0b3a848cb68139dd18d92efd3955bc000e
SHA51216dd7b670625fa49260f33d56b9bfab9e61982d39d989f32346bc12d952893c82df3402646d32133c66cd60291c97e1a59244ea467428fe39bcab7af1a3daff8
-
Filesize
72KB
MD5286d9f2e4b5b1728074b1df57bbd2ee0
SHA13d6ca9b5a4db8035c35bb8294dca786917f95bd7
SHA256ec7f0d4ff01fe4de50ca8fc99782ba8dcd1749f526f64ee1bc96094819cee745
SHA5128361492552ed0fdc5d544a2f21f1b09591473349a0409a2fd4b80f6536194d8ecf01a93944ad9725a52bd31ece31c4a5e52e82155d9ca4e5881d76e5d1715983
-
Filesize
72KB
MD5286d9f2e4b5b1728074b1df57bbd2ee0
SHA13d6ca9b5a4db8035c35bb8294dca786917f95bd7
SHA256ec7f0d4ff01fe4de50ca8fc99782ba8dcd1749f526f64ee1bc96094819cee745
SHA5128361492552ed0fdc5d544a2f21f1b09591473349a0409a2fd4b80f6536194d8ecf01a93944ad9725a52bd31ece31c4a5e52e82155d9ca4e5881d76e5d1715983
-
Filesize
72KB
MD538bc9f423e2e35637de6d0bd321fc2f6
SHA1e4ba499a3936134b05ebf469b73f713f1090a9ca
SHA256341ef1071a42f6347db0402f86b4807283a8b905b405e15d3989b1797c64c882
SHA512f489c6d4a838718f34f58558f9c4a175e0d4440f3705817a00f671e92840a7f3b46276ddf7b839379d6182c02f0c735854fd99643ad5270eb495aeb968d1488d
-
Filesize
72KB
MD538bc9f423e2e35637de6d0bd321fc2f6
SHA1e4ba499a3936134b05ebf469b73f713f1090a9ca
SHA256341ef1071a42f6347db0402f86b4807283a8b905b405e15d3989b1797c64c882
SHA512f489c6d4a838718f34f58558f9c4a175e0d4440f3705817a00f671e92840a7f3b46276ddf7b839379d6182c02f0c735854fd99643ad5270eb495aeb968d1488d
-
Filesize
72KB
MD528da7f92d20426930987cbae61ab8d3f
SHA17c1bb1a8a5b0028e3fb70fa7a7c75f64fff221a2
SHA256c10aa6dfcdcc72c3aa4d909fc1318c0b3a848cb68139dd18d92efd3955bc000e
SHA51216dd7b670625fa49260f33d56b9bfab9e61982d39d989f32346bc12d952893c82df3402646d32133c66cd60291c97e1a59244ea467428fe39bcab7af1a3daff8
-
Filesize
72KB
MD528da7f92d20426930987cbae61ab8d3f
SHA17c1bb1a8a5b0028e3fb70fa7a7c75f64fff221a2
SHA256c10aa6dfcdcc72c3aa4d909fc1318c0b3a848cb68139dd18d92efd3955bc000e
SHA51216dd7b670625fa49260f33d56b9bfab9e61982d39d989f32346bc12d952893c82df3402646d32133c66cd60291c97e1a59244ea467428fe39bcab7af1a3daff8
-
Filesize
72KB
MD538bc9f423e2e35637de6d0bd321fc2f6
SHA1e4ba499a3936134b05ebf469b73f713f1090a9ca
SHA256341ef1071a42f6347db0402f86b4807283a8b905b405e15d3989b1797c64c882
SHA512f489c6d4a838718f34f58558f9c4a175e0d4440f3705817a00f671e92840a7f3b46276ddf7b839379d6182c02f0c735854fd99643ad5270eb495aeb968d1488d
-
Filesize
72KB
MD538bc9f423e2e35637de6d0bd321fc2f6
SHA1e4ba499a3936134b05ebf469b73f713f1090a9ca
SHA256341ef1071a42f6347db0402f86b4807283a8b905b405e15d3989b1797c64c882
SHA512f489c6d4a838718f34f58558f9c4a175e0d4440f3705817a00f671e92840a7f3b46276ddf7b839379d6182c02f0c735854fd99643ad5270eb495aeb968d1488d
-
Filesize
72KB
MD598133efd0fe6a57f2dffef158470f9c5
SHA187c9f54bbb6ec83b0be67a37485c28c4825a686b
SHA256b7bdb605a6a3dd78d120025b26cae670382d5e9c67b1845a8ce2c7c7eee0baf2
SHA512ed8a407eed395ab9b5a4551d0e8cd9d662e8166e2abb4acfc3c4b974d68730aeb69e3a60f5c4ec3b2012b9c1a63e364414c1282a18fac8504ae3194d95dbdced
-
Filesize
72KB
MD514b0a6b7db12e78c01b2a161abbb3f6a
SHA1804fd228a75d657f0fbdb91d8b239a8844f402fe
SHA256cf8c01efe000d13f5d5f8e736f4930d5e45ffa841e62ef047072292aed08856d
SHA512b118ee5c6f83eb8c9c3e949d4abfc9750c70112e9fda9cca94d4a9b2b6b84e5d4d4f4ffd9c38f737b95872395b693d94fadef88e7dafc70be3ac75c2051ac9cd
-
Filesize
72KB
MD514b0a6b7db12e78c01b2a161abbb3f6a
SHA1804fd228a75d657f0fbdb91d8b239a8844f402fe
SHA256cf8c01efe000d13f5d5f8e736f4930d5e45ffa841e62ef047072292aed08856d
SHA512b118ee5c6f83eb8c9c3e949d4abfc9750c70112e9fda9cca94d4a9b2b6b84e5d4d4f4ffd9c38f737b95872395b693d94fadef88e7dafc70be3ac75c2051ac9cd
-
Filesize
72KB
MD55e14d061f334ab3f9dfde5d3d5dce611
SHA194e64b32d9a3671fe33ed9a456d83678f3b86562
SHA2561a7827ff29a6ecc7e279072e425df0da9e8e4e2fa997fc51b025ff17d2685107
SHA512483e36245939022c1146c0a219e9a609ac51b9f0b65a8bdd4d1605c355e6fc7713aeb9af2b8d21291d202222182677a8f07fe27f8c66c5a645b5b4f7b4bf2d13
-
Filesize
72KB
MD55e14d061f334ab3f9dfde5d3d5dce611
SHA194e64b32d9a3671fe33ed9a456d83678f3b86562
SHA2561a7827ff29a6ecc7e279072e425df0da9e8e4e2fa997fc51b025ff17d2685107
SHA512483e36245939022c1146c0a219e9a609ac51b9f0b65a8bdd4d1605c355e6fc7713aeb9af2b8d21291d202222182677a8f07fe27f8c66c5a645b5b4f7b4bf2d13
-
Filesize
72KB
MD5fbc286da952d8481a44cc828639b16da
SHA186444651a5a8b05936290404688f0d9693778d28
SHA2565f4c9bc1de9c2a62aa1c54815b956f16c7f75ff4c4012805c264536cfbf77348
SHA5125a4dd742f3bc46b5b8147af46f14e1a121f5beb7740de3a4caf7c2eae6735229afb0e65ca3f7b55f0041f72530cf92ff91fd07ad449b6cba3362a6057fcfa0b7
-
Filesize
72KB
MD5fbc286da952d8481a44cc828639b16da
SHA186444651a5a8b05936290404688f0d9693778d28
SHA2565f4c9bc1de9c2a62aa1c54815b956f16c7f75ff4c4012805c264536cfbf77348
SHA5125a4dd742f3bc46b5b8147af46f14e1a121f5beb7740de3a4caf7c2eae6735229afb0e65ca3f7b55f0041f72530cf92ff91fd07ad449b6cba3362a6057fcfa0b7
-
Filesize
72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
Filesize
72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
Filesize
72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
Filesize
72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
Filesize
72KB
MD5fbc286da952d8481a44cc828639b16da
SHA186444651a5a8b05936290404688f0d9693778d28
SHA2565f4c9bc1de9c2a62aa1c54815b956f16c7f75ff4c4012805c264536cfbf77348
SHA5125a4dd742f3bc46b5b8147af46f14e1a121f5beb7740de3a4caf7c2eae6735229afb0e65ca3f7b55f0041f72530cf92ff91fd07ad449b6cba3362a6057fcfa0b7
-
Filesize
72KB
MD5fbc286da952d8481a44cc828639b16da
SHA186444651a5a8b05936290404688f0d9693778d28
SHA2565f4c9bc1de9c2a62aa1c54815b956f16c7f75ff4c4012805c264536cfbf77348
SHA5125a4dd742f3bc46b5b8147af46f14e1a121f5beb7740de3a4caf7c2eae6735229afb0e65ca3f7b55f0041f72530cf92ff91fd07ad449b6cba3362a6057fcfa0b7
-
Filesize
72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea
-
Filesize
72KB
MD5d786468dd21542343b1e995b666cd509
SHA1442d38041e76ed86be15cdcebfd8c7cf9036a2c7
SHA256241fb0c75c50cd415ac3baa82d80f65c3bb0abed7799d161d60aa0a52855fc3b
SHA512be3b7f17bc290205a5be86a44287b6d55fedccd57688507aeeb35db3da7f8edc993738bb9fe9ae8c6daf143291308eaa9d653693c87ef35ee5f8843b4a307eea